oauth.net
Mutual TLS Client Authentication and Certificate-Bound Access Tokens
Mutual TLS provides two things: a way for OAuth clients to authenticate using TLS client certificates, and a way to bind access tokens to a client certificate so stolen tokens can't be used without it.
When to use this
Use Mutual TLS when your deployment already has TLS certificate infrastructure — common in enterprise and financial environments. It's required or recommended by FAPI 2.0. If you don't have certificate infrastructure, DPoP provides similar sender-constraining using asymmetric keys without requiring TLS-level certificates.
mTLS covers two complementary mechanisms. First, client authentication: the client presents its X.509 certificate during the TLS handshake, which the authorization server validates. Second, certificate-bound access tokens: the authorization server embeds a fingerprint of the client's certificate in the access token, and the resource server verifies that the presenting client's certificate matches on each request.
See also
- Client Authentication
- DPoP RFC 9449 — key-based sender-constraining alternative
- Private Key JWT